AIKIDO-2026-695913

fast-uri is vulnerable to Host Confusion

Host ConfusionCVE-2026-76172 Published 2 days ago

High Risk

This Affects:

fast-uri

2.3.1 - 2.4.4

Fixed in 2.4.5

3.0.0 - 3.1.5

Fixed in 3.1.6

4.0.0 - 4.1.2

Fixed in 4.1.3

Are you affected? Scan for Free

TL;DR

The library decodes percent-encoded characters in the scheme component using the legacy global unescape() and reserializes them without validation. Input such as %2f%2fevil.example:/pwn parses with no authority, but normalize() and resolve() emit //evil.example:/pwn, which reparses with an externally chosen host, and encoded %0d%0a can inject carriage returns and line feeds. Applications normalizing untrusted URLs before redirects, allowlist checks, or outbound requests can be misdirected, and normalized values placed in headers risk injection. The fix validates the scheme against RFC 3986 grammar and stops the unsafe decoding in parse(), normalize(), and resolve().

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application parses, normalizes, or resolves untrusted or externally influenced URIs before redirects, allowlist checks, or outbound requests.